CVE-2025-3155
High · 7.4CVSS
7.4
EPSS
13.1%
Published
Apr 3, 2025
CISA due date
—
The record
A flaw was found in Yelp. The Gnome user help application allows the help document to execute arbitrary scripts. This vulnerability allows malicious users to input help documents, which may exfiltrate user files to an external environment.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| AlmaLinux:8 | yelp | 0 | 2:3.28.1-3.el8_10.1 |
| AlmaLinux:8 | yelp-devel | 0 | 2:3.28.1-3.el8_10.1 |
| AlmaLinux:8 | yelp-libs | 0 | 2:3.28.1-3.el8_10.1 |
| AlmaLinux:8 | yelp-xsl | 0 | 3.28.0-2.el8_10.1 |
| AlmaLinux:9 | yelp | 0 | 2:40.3-2.el9_6.1 |
| AlmaLinux:9 | yelp-devel | 0 | 2:40.3-2.el9_6.1 |
| AlmaLinux:9 | yelp-libs | 0 | 2:40.3-2.el9_6.1 |
| Debian:11 | yelp | 0 | No fix |
| Debian:11 | yelp-xsl | 0 | No fix |
| Debian:12 | yelp | 0 | No fix |
| Debian:12 | yelp-xsl | 0 | No fix |
| Debian:13 | yelp | 0 | No fix |
| Debian:13 | yelp-xsl | 0 | 42.1-4 |
| Debian:14 | yelp | 0 | 42.2-3 |
| Debian:14 | yelp-xsl | 0 | 42.1-4 |
| Mageia:9 | yelp | 0 | 42.2-1.1.mga9 |
| Mageia:9 | yelp-xsl | 0 | 42.1-1.1.mga9 |
| SUSE:Linux Enterprise Module for Desktop Applications 15 SP6 | yelp | 0 | 42.2-150600.3.3.1 |
| SUSE:Linux Enterprise Module for Desktop Applications 15 SP6 | yelp-xsl | 0 | 41.1-150400.3.3.1 |
| SUSE:Linux Enterprise Module for Desktop Applications 15 SP7 | yelp | 0 | 42.2-150600.3.3.1 |
| SUSE:Linux Enterprise Module for Desktop Applications 15 SP7 | yelp-xsl | 0 | 41.1-150400.3.3.1 |
| SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | yelp | 0 | 3.20.1-7.3.1 |
| SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | yelp-xsl | 0 | 3.20.1-6.3.1 |
| openSUSE:Leap 15.6 | yelp | 0 | 42.2-150600.3.3.1 |
| openSUSE:Leap 15.6 | yelp-xsl | 0 | 41.1-150400.3.3.1 |
| openSUSE:Tumbleweed | yelp | 0 | 42.2-4.1 |
| openSUSE:Tumbleweed | yelp-xsl | 0 | 42.1-2.1 |
Related vulnerabilities
- CVE-2008-3533 Format string vulnerability in the window_error function in yelp-window.c in yelp in… Also affects yelp
- CVE-2026-87945 URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal SAML SSO… CWE-601
- CVE-2026-87937 URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Central… CWE-601
- CVE-2026-112034 A weakness has been identified in aircheng-org iWebShop-5 up to 5.16. CWE-601
- CVE-2026-101907 Axios is a promise-based HTTP client for the browser and Node.js. CWE-601
- CVE-2026-8323 URL redirection to untrusted site ('open redirect') vulnerability in Armiya Information… CWE-601
- CVE-2026-78377 URL redirection to untrusted site ('open redirect') vulnerability in Yordam Informatics… CWE-601
- CVE-2026-81741 The Groundhogg — CRM, Newsletters, and Marketing Automation WordPress plugin before 4.7.2… CWE-601